Forum Thread

Modem Hacked?

stufine 6,163 February 2, 2016 at 06:45 PM
Today I was going through my modem logs to see why my IP settings were changed from 192. to 10. I looked at attached devices and saw this, which is pretty normal now that the ip has changed to 10 .

Then I clicked refresh and got the second pic with other addresses. Not sure where they came from, they were not listed in my firewall program.

I had read something about Time Warner changing my settings?

14 Comments

1

Sign up for a Slickdeals account to remove this ad.

Joined Jun 2008
I Trade Your Bing Credit$
737 Posts
82 Reputation
#2
try tomato if version 1
Reply Helpful Comment? 0 0
#3
Quote from stufine View Post :
Today I was going through my modem logs to see why my IP settings were changed from 192. to 10. I looked at attached devices and saw this, which is pretty normal now that the ip has changed to 10 .

Then I clicked refresh and got the second pic with other addresses. Not sure where they came from, they were not listed in my firewall program.

I had read something about Time Warner changing my settings?
That screenshot is from your router not your modem. It wouldn't just change from 192.168... to 10.... on it's own. Personally I use a 10.1.1.0/8 network it's just easier to type. Either someone with access to your network changed the setting or somebody got on your wifi.

I'd do the following if nobody fesses up:
-check for software updates for router, update if needed.
-Factory reset the router
-Set a long & complex WPA2 AES network key
-Disable WPS (if somebody hacked your wifi, this is probably how)
-Change web admin password for router
Reply Helpful Comment? 1 0
Joined Feb 2007
L10: Grand Master
6,163 Posts
Original Poster
#4
Quote from jkee View Post :
That screenshot is from your router not your modem. It wouldn't just change from 192.168... to 10.... on it's own. Personally I use a 10.1.1.0/8 network it's just easier to type. Either someone with access to your network changed the setting or somebody got on your wifi.

I'd do the following if nobody fesses up:
-check for software updates for router, update if needed.
-Factory reset the router
-Set a long & complex WPA2 AES network key
-Disable WPS (if somebody hacked your wifi, this is probably how)
-Change web admin password for router
you are correct, my router
it did change. I selected get info from isp months ago. I went in many times at 192, had trouble with DNS one day and went in to change it to google dns. That's when I noticed the 10 ip. changed it to 192 and about 3 days it went back to 10. I manually set to google dns so that doesn't change.

Not sure where those other ip's came from after the refresh, but not they don't show up.
Today it doesn't want to work Frown
Reply Helpful Comment? 0 0
for those that hate spelling mistakes www.walmarts.comCool

bulb save money by checking your insurance every 2 years (and not every 20)
Joined Aug 2005
L10: Grand Master
12,661 Posts
4,824 Reputation
Pro
#5
Quote from jkee View Post :
That screenshot is from your router not your modem. It wouldn't just change from 192.168... to 10.... on it's own. Personally I use a 10.1.1.0/8 network it's just easier to type. Either someone with access to your network changed the setting or somebody got on your wifi.

I'd do the following if nobody fesses up:
-check for software updates for router, update if needed.
-Factory reset the router
-Set a long & complex WPA2 AES network key
-Disable WPS (if somebody hacked your wifi, this is probably how)
-Change web admin password for router
Great advice and exactly what I would do too. OP could look at 3rd party firmware if he wanted. All the steps mentioned above are quite important and should not be forgotten.

Only thing I can think of is when OP did "Get info" it kind of autoconfigured something.
Reply Helpful Comment? 0 0
Vague questions receive vague answers . . . . . .
#6
Do you own your cable modem or rent it from twc? What model is it? Could it be a 'gateway' with a built in router?
Reply Helpful Comment? 0 0
#7
Depending on what model router / modem that is it could be something that is managed remotely by the cable company.
Those pages look like very basic, check and see if there is a admin log in page of some kind.

If you can list the full model number of the device we can look it up and see if its a remotely managed device or something else has gone wrong / been hacked. Smilie
Reply Helpful Comment? 0 0
#8
P.S. you can capture a screen shot of your computer by pressing the Print Screen button on your keyboard, paste the image into paint and save. You can also use the snipping tool found on in windows 7+. Edit images in paint, you can simply select a rectangle and press delete to hide part of the image. You don't need to resort to taking a photo of your monitor...

If you press Alt-Print Screen it will only capture the current window.
Reply Helpful Comment? 0 0

Sign up for a Slickdeals account to remove this ad.

Joined Feb 2007
L10: Grand Master
6,163 Posts
Original Poster
#9
Quote from Muddog006 View Post :
Depending on what model router / modem that is it could be something that is managed remotely by the cable company.
Those pages look like very basic, check and see if there is a admin log in page of some kind.

If you can list the full model number of the device we can look it up and see if its a remotely managed device or something else has gone wrong / been hacked. Smilie
it's a Netgear WNDR3400

It was just odd to see the other IP addresses when I've never seen them before. Along with the scrambled info.
Reply Helpful Comment? 0 0
Joined Feb 2007
L10: Grand Master
6,163 Posts
Original Poster
#10
Quote from jkee View Post :
P.S. you can capture a screen shot of your computer by pressing the Print Screen button on your keyboard, paste the image into paint and save. You can also use the snipping tool found on in windows 7+. Edit images in paint, you can simply select a rectangle and press delete to hide part of the image. You don't need to resort to taking a photo of your monitor...

If you press Alt-Print Screen it will only capture the current window.
I know. It was in my hand
Reply Helpful Comment? 0 0
Joined Feb 2007
L10: Grand Master
6,163 Posts
Original Poster
#11
I'm about to give up.
I take the router out and put a switch in. I can get on fine all day, wife tries working from home today and her work laptop won't connect. Connects but says local only with 192 address from modem.

Everything works using her iphone hotspot

I put the router back in and hers works without any problems

The switch and/or router line is connected to Timewarner arris modem.
Her work laptop has the typical vpn citrix etc. a large corp would have.
I looked in the modem to make sure I wasn't limited on IP's
Reply Helpful Comment? 0 0
Joined Oct 2009
Shop smart. Shop S-Mart!
3,848 Posts
160 Reputation
#12
I think I've seen that gibberish on my 10+ yr old netgear as well. In my case, it was just an issue displaying 1 wireless device like an iphone. I disconnected it and the web form showed the rest of the devices just fine.
Reply Helpful Comment? 0 0
#13
Quote from stufine View Post :
I'm about to give up.
I take the router out and put a switch in. I can get on fine all day, wife tries working from home today and her work laptop won't connect. Connects but says local only with 192 address from modem.
If the 'modem' is handing out ip addresses in 192.168... it's a gateway with a built in router.
Reply Helpful Comment? 0 0
Joined Oct 2009
Shop smart. Shop S-Mart!
3,848 Posts
160 Reputation
#14
OP are you using the netgear genie app? I'd disable the parental controls for now, if enabled or turned on.

The router is not a gateway + router.

Looks like: This product is backed by a NETGEAR limited Lifetime Hardware warranty. Give them a call and see if they can help decide if its a hardware issue.
Reply Helpful Comment? 0 0
Joined Feb 2007
L10: Grand Master
6,163 Posts
Original Poster
#15
Quote from ashcampbell View Post :
I think I've seen that gibberish on my 10+ yr old netgear as well. In my case, it was just an issue displaying 1 wireless device like an iphone. I disconnected it and the web form showed the rest of the devices just fine.
that's what I thought until I saw the IP's on the left and they were from .se and other countries.. didn't see chinaSmilie

Maybe it picked up some port scans...I can't get it to repeat though
Reply Helpful Comment? 0 0
Page 1 of 1
1
Join the Conversation
Add a Comment
 
Copyright 1999 - 2016. Slickdeals, LLC. All Rights Reserved. Copyright / Infringement Policy  •  Privacy Policy  •  Terms of Service  •  Acceptable Use Policy (Rules)  •  Interest-Based Ads
Link Copied to Clipboard